Extendedengine malware (??)
Fermé
LaPrunette
Messages postés
3
Date d'inscription
mardi 11 novembre 2008
Statut
Membre
Dernière intervention
16 novembre 2008
-
11 nov. 2008 à 17:17
LaPrunette Messages postés 3 Date d'inscription mardi 11 novembre 2008 Statut Membre Dernière intervention 16 novembre 2008 - 16 nov. 2008 à 00:28
LaPrunette Messages postés 3 Date d'inscription mardi 11 novembre 2008 Statut Membre Dernière intervention 16 novembre 2008 - 16 nov. 2008 à 00:28
A voir également:
- Extendedengine malware (??)
- Malware byte - Télécharger - Antivirus & Antimalwares
- Tor.jack malware - Forum Antivirus
- Supprimer malware - Guide
- Anti malware service executable ram - Forum Antivirus
- Win64 malware gen - Forum Virus
3 réponses
LaPrunette
Messages postés
3
Date d'inscription
mardi 11 novembre 2008
Statut
Membre
Dernière intervention
16 novembre 2008
11 nov. 2008 à 17:44
11 nov. 2008 à 17:44
ET voici le rapport combofix:
ComboFix 08-11-10.01 - Pierre 2008-11-11 17:27:12.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.513 [GMT 1:00]
Lancé depuis: c:\documents and settings\Pierre\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\[u]0/u8dgu.com
C:\68.exe
C:\9.cmd
C:\Autorun.inf
C:\b.exe
C:\bo1dhu.bat
c:\documents and settings\All Users\Bureau\webmediaplayer.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Désinstaller.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.url
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu.dat
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu.exe
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu_nav.dat
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu_navps.dat
C:\ev60a2.cmd
C:\itsduel.exe
C:\n6t1h.cmd
C:\nq0cq.cmd
C:\pnt.com
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\wmp_translation_file.xml
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\WebMediaPlayer.exe
C:\vva0hc0p.cmd
c:\windows\smdat32m.sys
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000125_.tmp.dll
c:\windows\system32\_006183_.tmp.dll
c:\windows\system32\_006184_.tmp.dll
c:\windows\system32\_006185_.tmp.dll
c:\windows\system32\_006186_.tmp.dll
c:\windows\system32\_006193_.tmp.dll
c:\windows\system32\_006194_.tmp.dll
c:\windows\system32\_006195_.tmp.dll
c:\windows\system32\_006196_.tmp.dll
c:\windows\system32\_006198_.tmp.dll
c:\windows\system32\_006199_.tmp.dll
c:\windows\system32\_006202_.tmp.dll
c:\windows\system32\_006203_.tmp.dll
c:\windows\system32\_006205_.tmp.dll
c:\windows\system32\_006206_.tmp.dll
c:\windows\system32\_006207_.tmp.dll
c:\windows\system32\_006208_.tmp.dll
c:\windows\system32\_006209_.tmp.dll
c:\windows\system32\_006212_.tmp.dll
c:\windows\system32\_006213_.tmp.dll
c:\windows\system32\_006217_.tmp.dll
c:\windows\system32\_006218_.tmp.dll
c:\windows\system32\_006220_.tmp.dll
c:\windows\system32\_006223_.tmp.dll
c:\windows\system32\_006225_.tmp.dll
c:\windows\system32\_006226_.tmp.dll
c:\windows\system32\_006227_.tmp.dll
c:\windows\system32\_006228_.tmp.dll
c:\windows\system32\_006229_.tmp.dll
c:\windows\system32\_006232_.tmp.dll
c:\windows\system32\_006233_.tmp.dll
c:\windows\system32\_006234_.tmp.dll
c:\windows\system32\_006235_.tmp.dll
c:\windows\system32\_006236_.tmp.dll
c:\windows\system32\_006241_.tmp.dll
c:\windows\system32\_006243_.tmp.dll
c:\windows\system32\Bitkv0.dll
c:\windows\system32\system
c:\windows\system32\system\msxml4.dll
c:\windows\system32\system\msxml4r.dll
C:\xih9.cmd
D:\[u]0/u8dgu.com
D:\68.exe
D:\9.cmd
D:\Autorun.inf
D:\b.exe
D:\bo1dhu.bat
D:\ev60a2.cmd
D:\itsduel.exe
D:\n6t1h.cmd
D:\nq0cq.cmd
D:\pnt.com
D:\vva0hc0p.cmd
D:\xih9.cmd
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-11 au 2008-11-11 ))))))))))))))))))))))))))))))))))))
.
2008-11-11 16:46 . 2008-11-11 16:46 66 --ah----- C:\aaw7boot.cmd
2008-11-11 02:27 . 2008-07-07 21:28 253,952 --------- c:\windows\system32\SET3D.tmp
2008-11-11 02:27 . 2008-06-24 17:44 74,240 --------- c:\windows\system32\SET41.tmp
2008-11-11 01:59 . 2008-04-13 19:33 2,843,136 --a------ c:\windows\system32\SET49A.tmp
2008-11-11 01:58 . 2008-04-13 19:33 8,517,632 --a------ c:\windows\system32\SET3C1.tmp
2008-11-11 01:56 . 2006-12-28 12:01 19,569 --a------ c:\windows\[u]0/u05547_.tmp
2008-11-11 01:56 . 2008-11-11 02:22 2,711 --a------ c:\windows\imsins.BAK
2008-11-10 17:48 . 2008-11-11 01:09 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-09 17:14 . 2008-11-09 13:10 110,013 -r-hs---- C:\whi.com
2008-11-07 09:20 . 2008-11-09 13:10 110,013 -r-hs---- C:\sq.com
2008-11-06 00:35 . 2008-11-06 00:35 <REP> d-------- c:\documents and settings\All Users\Application Data\wmp
2008-11-04 23:18 . 2008-11-04 23:18 <REP> d-------- C:\Downloads
2008-11-04 23:18 . 2008-11-04 23:18 <REP> d-------- c:\documents and settings\Pierre\Application Data\GetRightToGo
2008-11-03 22:49 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\SET31.tmp
2008-11-03 22:49 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\SET11C3.tmp
2008-11-03 22:49 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SETC.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --a------ c:\windows\system32\SET77.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1EC.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1EB.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1D4.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET19F.tmp
2008-10-22 07:00 . 2008-10-22 15:04 104,123 -r-hs---- C:\xlk9.com
2008-10-17 17:40 . 2008-10-21 18:54 103,973 -r-hs---- C:\2fiji.com
2008-10-17 15:14 . 2008-10-17 15:14 <REP> d-------- c:\documents and settings\Pierre\Application Data\Canneverbe_Limited
2008-10-17 15:13 . 2008-10-17 15:14 <REP> d-------- c:\program files\CDBurnerXP
2008-10-17 07:16 . 2008-11-11 17:33 54,156 --ah----- c:\windows\QTFont.qfn
2008-10-17 07:16 . 2008-10-17 07:16 1,409 --a------ c:\windows\QTFont.for
2008-10-16 01:05 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-16 01:05 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-16 01:05 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 23:38 . 2008-10-15 23:39 <REP> d-------- c:\program files\StuffPlug3
2008-10-15 23:35 . 2008-11-11 02:03 <REP> d-------- c:\windows\system32\fr-fr
2008-10-15 22:50 . 2008-10-15 22:50 <REP> d-------- c:\program files\Sygate
2008-10-15 11:59 . 2006-08-22 23:28 66,048 --a------ c:\windows\ieResetIcons.exe
2008-10-15 11:51 . 2008-10-15 11:51 <REP> d-------- c:\program files\CCleaner
2008-10-15 11:29 . 2008-10-15 11:29 <REP> d-------- c:\program files\Defraggler
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 16:34 --------- d-----w c:\documents and settings\Pierre\Application Data\Skype
2008-11-11 14:18 --------- d-----w c:\program files\Lavasoft
2008-11-11 14:08 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-10 16:48 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-11-08 17:42 --------- d-----w c:\program files\Mozilla Thunderbird
2008-11-06 17:26 --------- d-----w c:\program files\Lexmark 3100 Series
2008-11-05 15:45 --------- d-----w c:\documents and settings\Pierre\Application Data\OpenOffice.org2
2008-10-17 13:58 --------- d-----w c:\documents and settings\Pierre\Application Data\FileZilla
2008-10-15 10:58 --------- d-----w c:\program files\DivX
2008-10-15 10:32 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-10-15 10:25 --------- d-----w c:\program files\Java
2008-10-14 21:53 --------- d-----w c:\program files\eMule
2008-10-10 14:22 --------- d-----w c:\program files\DynDNS Updater
2008-10-10 14:22 --------- d-----w c:\documents and settings\All Users\Application Data\DynDNS
2008-10-03 17:12 6,066,176 ------w c:\windows\system32\SET16D.tmp
2008-09-30 15:02 --------- d-----w c:\program files\VirtualDub-MPEG2
2008-09-29 20:36 --------- d-----w c:\program files\winLAME
2008-09-29 11:01 --------- d-----w c:\program files\Zattoo
2008-09-24 20:36 --------- d-----w c:\program files\Orange
2008-09-24 20:32 --------- d-----w c:\program files\mIRC
2008-09-24 20:17 --------- d-----w c:\program files\Windows Live
2008-09-24 19:16 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-09-23 22:44 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-09-23 22:44 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-09-23 22:39 --------- d-----w c:\documents and settings\Pierre\Application Data\Symantec
2008-09-22 17:02 --------- d-----w c:\program files\Alwil Software
2008-09-22 16:15 --------- d-----w c:\program files\Messenger Plus! Live
2008-09-19 16:31 --------- d-----w c:\program files\CardDetector
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-08-27 12:41 3,593,216 ------w c:\windows\system32\SET167.tmp
2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-26 08:11 826,368 ------w c:\windows\system32\SET15E.tmp
2008-08-26 08:11 267,776 ------w c:\windows\system32\SET16B.tmp
2008-08-26 08:11 233,472 ------w c:\windows\system32\SET15F.tmp
2008-08-26 08:11 124,928 ------w c:\windows\system32\SET176.tmp
2008-08-26 08:11 105,984 ------w c:\windows\system32\SET161.tmp
2008-08-26 08:11 1,159,680 ------w c:\windows\system32\SET160.tmp
2008-08-14 13:23 2,147,328 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:23 2,025,984 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-01-27 21:14 92,064 ----a-w c:\documents and settings\Pierre\mqdmmdm.sys
2008-01-27 21:14 9,232 ----a-w c:\documents and settings\Pierre\mqdmmdfl.sys
2008-01-27 21:14 79,328 ----a-w c:\documents and settings\Pierre\mqdmserd.sys
2008-01-27 21:14 66,656 ----a-w c:\documents and settings\Pierre\mqdmbus.sys
2008-01-27 21:14 6,208 ----a-w c:\documents and settings\Pierre\mqdmcmnt.sys
2008-01-27 21:14 5,936 ----a-w c:\documents and settings\Pierre\mqdmwhnt.sys
2008-01-27 21:14 4,048 ----a-w c:\documents and settings\Pierre\mqdmcr.sys
2008-01-27 21:14 25,600 ----a-w c:\documents and settings\Pierre\usbsermptxp.sys
2008-01-27 21:14 22,768 ----a-w c:\documents and settings\Pierre\usbsermpt.sys
2007-11-04 23:07 66,200 -c--a-w c:\documents and settings\Pierre\Application Data\GDIPFONTCACHEV1.DAT
2005-09-12 20:44 594,527 -c--a-w c:\program files\lftp13.7z
2005-05-28 15:01 56 --sh--r c:\windows\system32\BF3F0896E4.sys
2005-05-28 15:01 10,022 --sha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-12-18 25365032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-20 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-04-07 631364]
"Lexmark 3100 Series"="c:\program files\Lexmark 3100 Series\lxbrbmgr.exe" [2003-09-04 106496]
"LXBRKsk"="c:\progra~1\LEXMAR~1\LXBRKsk.exe" [2003-06-13 282624]
"LVCOMS"="c:\program files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"CardDetectorICON225"="c:\program files\CardDetector\ICON225\CardDetector.exe" [2007-11-13 278528]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-11-11 2468200]
"nwiz"="nwiz.exe" [2005-12-10 c:\windows\system32\nwiz.exe]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 c:\windows\LOGI_MWX.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-20 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DynDNS Updater.lnk - c:\program files\DynDNS Updater\DynUpPs.exe [2008-06-23 94208]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2004-07-22 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP53"= SP5X_32.DLL
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP59"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\TYPSoft FTP Server\\ftpserv.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=
"c:\\Program Files\\FileZilla Server\\FileZilla Server Interface.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\Program Files\\Zattoo\\Zattoo2.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 lusbaudio;Logitech USB Microphone;c:\windows\system32\drivers\lvsound2.sys [2002-06-10 34816]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R3 LVBulk;LVBulk Service;c:\windows\system32\DRIVERS\LVBulk.sys [2002-06-10 10254]
R3 LVVI500A;LVVI500A Service;c:\windows\system32\DRIVERS\lvvi500a.sys [2002-06-10 188592]
R3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-11-13 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-11-13 51968]
S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-11-13 8064]
S3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2002-11-08 14156]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{505b6d8e-9c50-11dd-b9ce-00e04c015bd1}]
\Shell\AutoRun\command - F:\b.exe
\Shell\explore\Command - F:\b.exe
\Shell\open\Command - F:\b.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e5f20a1-8004-11dd-b99f-00e04c015bd1}]
\Shell\AutoRun\command - F:\fn20.exe
\Shell\explore\Command - F:\fn20.exe
\Shell\open\Command - F:\fn20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67e98b64-8668-11dd-b9a8-00e04c015bd1}]
\Shell\AutoRun\command - H:\AutoRunCardDetector.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91b8b8c1-d964-11db-a49b-4d6564696130}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{956a417c-adb5-11dd-b9d7-00e04c015bd1}]
\Shell\AutoRun\command - F:\sq.com
\Shell\explore\Command - F:\sq.com
\Shell\open\Command - F:\sq.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{956a417d-adb5-11dd-b9d7-00e04c015bd1}]
\Shell\AutoRun\command - F:\sq.com
\Shell\explore\Command - F:\sq.com
\Shell\open\Command - F:\sq.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0efa6b4-866c-11dd-b9a9-00f1d000f1d0}]
\Shell\AutoRun\command - G:\sq.com
\Shell\explore\Command - G:\sq.com
\Shell\open\Command - G:\sq.com
.
Contenu du dossier 'Tâches planifiées'
2008-11-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
2008-11-11 c:\windows\Tasks\iTunes.job
- c:\documents and settings\All Users\Menu D []
2005-03-31 c:\windows\Tasks\Lecteur Windows Media.job
- c:\program files\Windows Media Player\wmplayer.exe [2004-08-11 19:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-LDM - \Program\BackWeb-8876480.exe
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-WinRoll - c:\documents and settings\Pierre\Bureau\winroll.exe
HKCU-Run-TheTurtle - c:\program files\TheTurtle\TheTurtle.exe
HKCU-Run-iosscmu - c:\documents and settings\pierre\local settings\application data\iosscmu.exe
HKCU-Run-Start WingMan Profiler - (no file)
HKCU-Run-WebCamRT.exe - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Run-QD FastAndSafe - (no file)
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe
Notify-WgaLogon - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Pierre\Application Data\Mozilla\Firefox\Profiles\tqrirm2k.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.fr
FF -: plugin - c:\documents and settings\Pierre\Application Data\Mozilla\Firefox\Profiles\tqrirm2k.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 17:31:05
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\FileZilla Server\FileZilla server.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Lexmark 3100 Series\lxbrbmon.exe
c:\windows\system32\wscntfy.exe
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\Lexmark 3100 Series\lxbrcmon.exe
c:\program files\OrangeHSS\Launcher\Launcher.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\DynDNS Updater\DynTray.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OrangeHSS\Systray\SystrayApp.exe
c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe
c:\program files\OrangeHSS\Connectivity\corecom\CoreCom.exe
c:\program files\OrangeHSS\Connectivity\corecom\OraConfigRecover.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\1\FTCOMModule.exe
.
**************************************************************************
.
Heure de fin: 2008-11-11 17:41:18 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-11 16:41:10
Avant-CF: 14 543 376 384 octets libres
Après-CF: 14,995,595,264 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn
384 --- E O F --- 2008-11-11 12:01:51
ComboFix 08-11-10.01 - Pierre 2008-11-11 17:27:12.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.513 [GMT 1:00]
Lancé depuis: c:\documents and settings\Pierre\Bureau\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\[u]0/u8dgu.com
C:\68.exe
C:\9.cmd
C:\Autorun.inf
C:\b.exe
C:\bo1dhu.bat
c:\documents and settings\All Users\Bureau\webmediaplayer.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Conditions générales.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Confidentialité.url
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Désinstaller.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk
c:\documents and settings\All Users\Menu Démarrer\Programmes\WebMediaPlayer\Website.url
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu.dat
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu.exe
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu_nav.dat
c:\documents and settings\Pierre\Local Settings\Application Data\iosscmu_navps.dat
C:\ev60a2.cmd
C:\itsduel.exe
C:\n6t1h.cmd
C:\nq0cq.cmd
C:\pnt.com
c:\program files\webmediaplayer
c:\program files\webmediaplayer\resources\wmp_translation_file.xml
c:\program files\webmediaplayer\skins\classic.skn
c:\program files\webmediaplayer\sqlite3.dll
c:\program files\webmediaplayer\WebMediaPlayer.exe
C:\vva0hc0p.cmd
c:\windows\smdat32m.sys
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\_000125_.tmp.dll
c:\windows\system32\_006183_.tmp.dll
c:\windows\system32\_006184_.tmp.dll
c:\windows\system32\_006185_.tmp.dll
c:\windows\system32\_006186_.tmp.dll
c:\windows\system32\_006193_.tmp.dll
c:\windows\system32\_006194_.tmp.dll
c:\windows\system32\_006195_.tmp.dll
c:\windows\system32\_006196_.tmp.dll
c:\windows\system32\_006198_.tmp.dll
c:\windows\system32\_006199_.tmp.dll
c:\windows\system32\_006202_.tmp.dll
c:\windows\system32\_006203_.tmp.dll
c:\windows\system32\_006205_.tmp.dll
c:\windows\system32\_006206_.tmp.dll
c:\windows\system32\_006207_.tmp.dll
c:\windows\system32\_006208_.tmp.dll
c:\windows\system32\_006209_.tmp.dll
c:\windows\system32\_006212_.tmp.dll
c:\windows\system32\_006213_.tmp.dll
c:\windows\system32\_006217_.tmp.dll
c:\windows\system32\_006218_.tmp.dll
c:\windows\system32\_006220_.tmp.dll
c:\windows\system32\_006223_.tmp.dll
c:\windows\system32\_006225_.tmp.dll
c:\windows\system32\_006226_.tmp.dll
c:\windows\system32\_006227_.tmp.dll
c:\windows\system32\_006228_.tmp.dll
c:\windows\system32\_006229_.tmp.dll
c:\windows\system32\_006232_.tmp.dll
c:\windows\system32\_006233_.tmp.dll
c:\windows\system32\_006234_.tmp.dll
c:\windows\system32\_006235_.tmp.dll
c:\windows\system32\_006236_.tmp.dll
c:\windows\system32\_006241_.tmp.dll
c:\windows\system32\_006243_.tmp.dll
c:\windows\system32\Bitkv0.dll
c:\windows\system32\system
c:\windows\system32\system\msxml4.dll
c:\windows\system32\system\msxml4r.dll
C:\xih9.cmd
D:\[u]0/u8dgu.com
D:\68.exe
D:\9.cmd
D:\Autorun.inf
D:\b.exe
D:\bo1dhu.bat
D:\ev60a2.cmd
D:\itsduel.exe
D:\n6t1h.cmd
D:\nq0cq.cmd
D:\pnt.com
D:\vva0hc0p.cmd
D:\xih9.cmd
.
((((((((((((((((((((((((((((( Fichiers créés du 2008-10-11 au 2008-11-11 ))))))))))))))))))))))))))))))))))))
.
2008-11-11 16:46 . 2008-11-11 16:46 66 --ah----- C:\aaw7boot.cmd
2008-11-11 02:27 . 2008-07-07 21:28 253,952 --------- c:\windows\system32\SET3D.tmp
2008-11-11 02:27 . 2008-06-24 17:44 74,240 --------- c:\windows\system32\SET41.tmp
2008-11-11 01:59 . 2008-04-13 19:33 2,843,136 --a------ c:\windows\system32\SET49A.tmp
2008-11-11 01:58 . 2008-04-13 19:33 8,517,632 --a------ c:\windows\system32\SET3C1.tmp
2008-11-11 01:56 . 2006-12-28 12:01 19,569 --a------ c:\windows\[u]0/u05547_.tmp
2008-11-11 01:56 . 2008-11-11 02:22 2,711 --a------ c:\windows\imsins.BAK
2008-11-10 17:48 . 2008-11-11 01:09 <REP> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-09 17:14 . 2008-11-09 13:10 110,013 -r-hs---- C:\whi.com
2008-11-07 09:20 . 2008-11-09 13:10 110,013 -r-hs---- C:\sq.com
2008-11-06 00:35 . 2008-11-06 00:35 <REP> d-------- c:\documents and settings\All Users\Application Data\wmp
2008-11-04 23:18 . 2008-11-04 23:18 <REP> d-------- C:\Downloads
2008-11-04 23:18 . 2008-11-04 23:18 <REP> d-------- c:\documents and settings\Pierre\Application Data\GetRightToGo
2008-11-03 22:49 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\SET31.tmp
2008-11-03 22:49 . 2008-10-15 17:35 337,408 --------- c:\windows\system32\SET11C3.tmp
2008-11-03 22:49 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SETC.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --a------ c:\windows\system32\SET77.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1EC.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1EB.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET1D4.tmp
2008-11-03 22:49 . 2008-10-15 17:59 332,800 --------- c:\windows\system32\SET19F.tmp
2008-10-22 07:00 . 2008-10-22 15:04 104,123 -r-hs---- C:\xlk9.com
2008-10-17 17:40 . 2008-10-21 18:54 103,973 -r-hs---- C:\2fiji.com
2008-10-17 15:14 . 2008-10-17 15:14 <REP> d-------- c:\documents and settings\Pierre\Application Data\Canneverbe_Limited
2008-10-17 15:13 . 2008-10-17 15:14 <REP> d-------- c:\program files\CDBurnerXP
2008-10-17 07:16 . 2008-11-11 17:33 54,156 --ah----- c:\windows\QTFont.qfn
2008-10-17 07:16 . 2008-10-17 07:16 1,409 --a------ c:\windows\QTFont.for
2008-10-16 01:05 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-16 01:05 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-16 01:05 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-10-16 01:05 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-10-15 23:38 . 2008-10-15 23:39 <REP> d-------- c:\program files\StuffPlug3
2008-10-15 23:35 . 2008-11-11 02:03 <REP> d-------- c:\windows\system32\fr-fr
2008-10-15 22:50 . 2008-10-15 22:50 <REP> d-------- c:\program files\Sygate
2008-10-15 11:59 . 2006-08-22 23:28 66,048 --a------ c:\windows\ieResetIcons.exe
2008-10-15 11:51 . 2008-10-15 11:51 <REP> d-------- c:\program files\CCleaner
2008-10-15 11:29 . 2008-10-15 11:29 <REP> d-------- c:\program files\Defraggler
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-11 16:34 --------- d-----w c:\documents and settings\Pierre\Application Data\Skype
2008-11-11 14:18 --------- d-----w c:\program files\Lavasoft
2008-11-11 14:08 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-10 16:48 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2008-11-08 17:42 --------- d-----w c:\program files\Mozilla Thunderbird
2008-11-06 17:26 --------- d-----w c:\program files\Lexmark 3100 Series
2008-11-05 15:45 --------- d-----w c:\documents and settings\Pierre\Application Data\OpenOffice.org2
2008-10-17 13:58 --------- d-----w c:\documents and settings\Pierre\Application Data\FileZilla
2008-10-15 10:58 --------- d-----w c:\program files\DivX
2008-10-15 10:32 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-10-15 10:25 --------- d-----w c:\program files\Java
2008-10-14 21:53 --------- d-----w c:\program files\eMule
2008-10-10 14:22 --------- d-----w c:\program files\DynDNS Updater
2008-10-10 14:22 --------- d-----w c:\documents and settings\All Users\Application Data\DynDNS
2008-10-03 17:12 6,066,176 ------w c:\windows\system32\SET16D.tmp
2008-09-30 15:02 --------- d-----w c:\program files\VirtualDub-MPEG2
2008-09-29 20:36 --------- d-----w c:\program files\winLAME
2008-09-29 11:01 --------- d-----w c:\program files\Zattoo
2008-09-24 20:36 --------- d-----w c:\program files\Orange
2008-09-24 20:32 --------- d-----w c:\program files\mIRC
2008-09-24 20:17 --------- d-----w c:\program files\Windows Live
2008-09-24 19:16 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-09-23 22:44 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-09-23 22:44 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-09-23 22:39 --------- d-----w c:\documents and settings\Pierre\Application Data\Symantec
2008-09-22 17:02 --------- d-----w c:\program files\Alwil Software
2008-09-22 16:15 --------- d-----w c:\program files\Messenger Plus! Live
2008-09-19 16:31 --------- d-----w c:\program files\CardDetector
2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys
2008-08-27 12:41 3,593,216 ------w c:\windows\system32\SET167.tmp
2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-26 08:11 826,368 ------w c:\windows\system32\SET15E.tmp
2008-08-26 08:11 267,776 ------w c:\windows\system32\SET16B.tmp
2008-08-26 08:11 233,472 ------w c:\windows\system32\SET15F.tmp
2008-08-26 08:11 124,928 ------w c:\windows\system32\SET176.tmp
2008-08-26 08:11 105,984 ------w c:\windows\system32\SET161.tmp
2008-08-26 08:11 1,159,680 ------w c:\windows\system32\SET160.tmp
2008-08-14 13:23 2,147,328 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:23 2,025,984 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-01-27 21:14 92,064 ----a-w c:\documents and settings\Pierre\mqdmmdm.sys
2008-01-27 21:14 9,232 ----a-w c:\documents and settings\Pierre\mqdmmdfl.sys
2008-01-27 21:14 79,328 ----a-w c:\documents and settings\Pierre\mqdmserd.sys
2008-01-27 21:14 66,656 ----a-w c:\documents and settings\Pierre\mqdmbus.sys
2008-01-27 21:14 6,208 ----a-w c:\documents and settings\Pierre\mqdmcmnt.sys
2008-01-27 21:14 5,936 ----a-w c:\documents and settings\Pierre\mqdmwhnt.sys
2008-01-27 21:14 4,048 ----a-w c:\documents and settings\Pierre\mqdmcr.sys
2008-01-27 21:14 25,600 ----a-w c:\documents and settings\Pierre\usbsermptxp.sys
2008-01-27 21:14 22,768 ----a-w c:\documents and settings\Pierre\usbsermpt.sys
2007-11-04 23:07 66,200 -c--a-w c:\documents and settings\Pierre\Application Data\GDIPFONTCACHEV1.DAT
2005-09-12 20:44 594,527 -c--a-w c:\program files\lftp13.7z
2005-05-28 15:01 56 --sh--r c:\windows\system32\BF3F0896E4.sys
2005-05-28 15:01 10,022 --sha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-12-18 25365032]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-20 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-12-10 7311360]
"zBrowser Launcher"="c:\program files\Logitech\iTouch\iTouch.exe" [2003-04-07 631364]
"Lexmark 3100 Series"="c:\program files\Lexmark 3100 Series\lxbrbmgr.exe" [2003-09-04 106496]
"LXBRKsk"="c:\progra~1\LEXMAR~1\LXBRKsk.exe" [2003-06-13 282624]
"LVCOMS"="c:\program files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-12-10 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"ORAHSSSessionManager"="c:\program files\OrangeHSS\SessionManager\SessionManager.exe" [2007-12-12 107248]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"CardDetectorICON225"="c:\program files\CardDetector\ICON225\CardDetector.exe" [2007-11-13 278528]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\Ad-Watch.exe" [2008-11-11 2468200]
"nwiz"="nwiz.exe" [2005-12-10 c:\windows\system32\nwiz.exe]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 c:\windows\LOGI_MWX.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-20 15360]
"DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
DynDNS Updater.lnk - c:\program files\DynDNS Updater\DynUpPs.exe [2008-06-23 94208]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2004-07-22 450560]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.SP53"= SP5X_32.DLL
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
"VIDC.SP59"= SP5X_32.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Program Files\\TYPSoft FTP Server\\ftpserv.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Trillian\\trillian.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=
"c:\\Program Files\\FileZilla Server\\FileZilla Server Interface.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\OrangeHSS\\Connectivity\\ConnectivityManager.exe"=
"c:\\Program Files\\Zattoo\\zattood.exe"=
"c:\\Program Files\\Zattoo\\Zattoo2.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 lusbaudio;Logitech USB Microphone;c:\windows\system32\drivers\lvsound2.sys [2002-06-10 34816]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R3 LVBulk;LVBulk Service;c:\windows\system32\DRIVERS\LVBulk.sys [2002-06-10 10254]
R3 LVVI500A;LVVI500A Service;c:\windows\system32\DRIVERS\lvvi500a.sys [2002-06-10 188592]
R3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
R3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 GT72NDISIPXP;GT 72 IP NDIS;c:\windows\system32\DRIVERS\Gt51Ip.sys [2007-11-13 95744]
S3 GT72UBUS;GT 72 U BUS;c:\windows\system32\DRIVERS\gt72ubus.sys [2007-11-13 51968]
S3 GTPTSER;GT PT SER;c:\windows\system32\DRIVERS\gtptser.sys [2007-11-13 8064]
S3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2002-11-08 14156]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{505b6d8e-9c50-11dd-b9ce-00e04c015bd1}]
\Shell\AutoRun\command - F:\b.exe
\Shell\explore\Command - F:\b.exe
\Shell\open\Command - F:\b.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e5f20a1-8004-11dd-b99f-00e04c015bd1}]
\Shell\AutoRun\command - F:\fn20.exe
\Shell\explore\Command - F:\fn20.exe
\Shell\open\Command - F:\fn20.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67e98b64-8668-11dd-b9a8-00e04c015bd1}]
\Shell\AutoRun\command - H:\AutoRunCardDetector.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91b8b8c1-d964-11db-a49b-4d6564696130}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
\Shell\Open(&0)\command - Recycled\ctfmon.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{956a417c-adb5-11dd-b9d7-00e04c015bd1}]
\Shell\AutoRun\command - F:\sq.com
\Shell\explore\Command - F:\sq.com
\Shell\open\Command - F:\sq.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{956a417d-adb5-11dd-b9d7-00e04c015bd1}]
\Shell\AutoRun\command - F:\sq.com
\Shell\explore\Command - F:\sq.com
\Shell\open\Command - F:\sq.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0efa6b4-866c-11dd-b9a9-00f1d000f1d0}]
\Shell\AutoRun\command - G:\sq.com
\Shell\explore\Command - G:\sq.com
\Shell\open\Command - G:\sq.com
.
Contenu du dossier 'Tâches planifiées'
2008-11-05 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
2008-11-11 c:\windows\Tasks\iTunes.job
- c:\documents and settings\All Users\Menu D []
2005-03-31 c:\windows\Tasks\Lecteur Windows Media.job
- c:\program files\Windows Media Player\wmplayer.exe [2004-08-11 19:49]
.
- - - - ORPHELINS SUPPRIMES - - - -
HKCU-Run-LDM - \Program\BackWeb-8876480.exe
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-WinRoll - c:\documents and settings\Pierre\Bureau\winroll.exe
HKCU-Run-TheTurtle - c:\program files\TheTurtle\TheTurtle.exe
HKCU-Run-iosscmu - c:\documents and settings\pierre\local settings\application data\iosscmu.exe
HKCU-Run-Start WingMan Profiler - (no file)
HKCU-Run-WebCamRT.exe - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
HKLM-Run-QD FastAndSafe - (no file)
HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe
Notify-WgaLogon - (no file)
.
------- Examen supplémentaire -------
.
FireFox -: Profile - c:\documents and settings\Pierre\Application Data\Mozilla\Firefox\Profiles\tqrirm2k.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.yahoo.fr
FF -: plugin - c:\documents and settings\Pierre\Application Data\Mozilla\Firefox\Profiles\tqrirm2k.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07074039.dll
FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-11 17:31:05
Windows 5.1.2600 Service Pack 3 NTFS
Recherche de processus cachés ...
Recherche d'éléments en démarrage automatique cachés ...
Recherche de fichiers cachés ...
Scan terminé avec succès
Fichiers cachés: 0
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\drivers\CDAC11BA.EXE
c:\program files\FileZilla Server\FileZilla server.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Lexmark 3100 Series\lxbrbmon.exe
c:\windows\system32\wscntfy.exe
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\Lexmark 3100 Series\lxbrcmon.exe
c:\program files\OrangeHSS\Launcher\Launcher.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\DynDNS Updater\DynTray.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\[u]0/u\AlertModule.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OrangeHSS\Systray\SystrayApp.exe
c:\program files\OrangeHSS\Connectivity\ConnectivityManager.exe
c:\program files\OrangeHSS\Connectivity\corecom\CoreCom.exe
c:\program files\OrangeHSS\Connectivity\corecom\OraConfigRecover.exe
c:\progra~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\1\FTCOMModule.exe
.
**************************************************************************
.
Heure de fin: 2008-11-11 17:41:18 - La machine a redémarré
ComboFix-quarantined-files.txt 2008-11-11 16:41:10
Avant-CF: 14 543 376 384 octets libres
Après-CF: 14,995,595,264 octets libres
WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect /NoExecute=OptIn
384 --- E O F --- 2008-11-11 12:01:51
LaPrunette
Messages postés
3
Date d'inscription
mardi 11 novembre 2008
Statut
Membre
Dernière intervention
16 novembre 2008
16 nov. 2008 à 00:28
16 nov. 2008 à 00:28
ha? c'est pas bon...
bon j ai lancé Prevx CSI et apparemment il a détecté et effacé toutes ces cochonneries... voila ce que me dit maintenant "hijack this":
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:27:00, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Lexmark 3100 Series\lxbrcmon.exe
C:\Program Files\CardDetector\ICON225\CardDetector.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DynDNS Updater\DynUpPs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\DynDNS Updater\DynTray.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pierre\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: bhoEvents Class - {FC4C5EAE-66EE-11D4-BC67-0000E8E582D2} - C:\WINDOWS\e2bho.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CardDetectorICON225] C:\Program Files\CardDetector\ICON225\CardDetector.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [WinRoll] "C:\Documents and Settings\Pierre\Bureau\winroll.exe"
O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
O4 - HKCU\..\Run: [iosscmu] "c:\documents and settings\pierre\local settings\application data\iosscmu.exe" iosscmu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DynDNS Updater.lnk = C:\Program Files\DynDNS Updater\DynUpPs.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: EasyClick - {05575EC1-B47D-11d3-8F04-00105A9965CA} - C:\WINDOWS\e2bar.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://3ar1e-dan1elle3ontagne.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.isaackorea.net/update/ilkactx.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F1A6A4A-B9BD-41F9-95BD-D8AAC4036427}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
bon j ai lancé Prevx CSI et apparemment il a détecté et effacé toutes ces cochonneries... voila ce que me dit maintenant "hijack this":
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:27:00, on 16/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe
C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lexmark 3100 Series\lxbrbmon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Lexmark 3100 Series\lxbrcmon.exe
C:\Program Files\CardDetector\ICON225\CardDetector.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DynDNS Updater\DynUpPs.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\DynDNS Updater\DynTray.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\OrangeHSS\systray\systrayapp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Pierre\Bureau\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: bhoEvents Class - {FC4C5EAE-66EE-11D4-BC67-0000E8E582D2} - C:\WINDOWS\e2bho.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Lexmark 3100 Series] "C:\Program Files\Lexmark 3100 Series\lxbrbmgr.exe"
O4 - HKLM\..\Run: [LXBRKsk] C:\PROGRA~1\LEXMAR~1\LXBRKsk.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ORAHSSSessionManager] C:\Program Files\OrangeHSS\SessionManager\SessionManager.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [CardDetectorICON225] C:\Program Files\CardDetector\ICON225\CardDetector.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\Ad-Watch.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [WinRoll] "C:\Documents and Settings\Pierre\Bureau\winroll.exe"
O4 - HKCU\..\Run: [TheTurtle] C:\Program Files\TheTurtle\TheTurtle.exe
O4 - HKCU\..\Run: [iosscmu] "c:\documents and settings\pierre\local settings\application data\iosscmu.exe" iosscmu
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DynDNS Updater.lnk = C:\Program Files\DynDNS Updater\DynUpPs.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: EasyClick - {05575EC1-B47D-11d3-8F04-00105A9965CA} - C:\WINDOWS\e2bar.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://3ar1e-dan1elle3ontagne.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.isaackorea.net/update/ilkactx.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F1A6A4A-B9BD-41F9-95BD-D8AAC4036427}: NameServer = 80.10.246.2,80.10.246.129
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\1\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
